Skip to content

Local and remote audits

Inspect source code, scan a live URL, and add authentication without crossing origins.


Audit local source

A local audit reads the repository from disk. It can inspect code, configuration, dependencies, migrations, Git history, containers, infrastructure files, and CI workflows without uploading the project to Platform.

Audit a path
1vice audit .
2vice audit ../another-project

Control local scope

Run from the intended root and review .viceignore before suppressing generated or vendor paths. VICE follows its file and repository budgets, but very large history or dependency trees can still affect runtime.

Scan a live application

A remote scan inspects the deployed application from the outside. Use it for a target you own or are explicitly authorized to test.

Remote scan
vice scan https://app.example.com

Add authentication carefully

Use a scoped test account when the audit needs an authenticated route. VICE accepts either a cookie string or one authorization header for the intended origin.

Authenticated examples
1vice scan https://app.example.com --auth-cookie "session=<value>"
2vice scan https://app.example.com --auth-header "Authorization: Bearer <token>"
Credentials never follow another origin
Do not reuse authentication material across redirects or discovered hosts. Revoke the test credential if it was exposed in terminal history or logs.

Combine both views

Remote evidence shows what the deployed application exposes. Local evidence shows which code and configuration created the behavior. Use both before closing a high-impact finding.


Continue with VICE

Review the open source engine, modules, and scope controls.

Explore the VICE engine